CVE-2026-31953

Xibo is an open source digital signage platform with a web content management system and Windows display player software. A stored Cross-Site Scripting (XSS) vulnerability in versions prior to 4.4.1 allows an authenticated user with notification creation permissions to inject arbitrary JavaScript into the notification body. When the notification is set as an "interrupt," the payload executes automatically in the browser of any targeted user upon login, requiring zero user interaction. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Access to the Notification Centre to view past notifications, and include "Add Notification" button to allow for the creation of new notifications. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.

• CWE-79

• https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1Release Notes
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-85w9-c833-q4w2Vendor Advisory

Published

Apr 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31946OpenOlat is an open source web-based e-learning platform for…9.8
• CVE-2026-31949LibreChat is a ChatGPT clone with additional features. Prior…6.5
• CVE-2026-3195A flaw was found in QEMU. When reading input audio in the vi…7.4
• CVE-2026-31950LibreChat is a ChatGPT clone with additional features. In ve…5.3
• CVE-2026-31951LibreChat is a ChatGPT clone with additional features. In ve…5.7
• CVE-2026-31952Xibo is an open source digital signage platform with a web c…8.1
• CVE-2026-31954Emlog is an open source website building system. In 2.6.6 an…7.3
• CVE-2026-31955Xibo is an open source digital signage platform with a web c…4.9
• CVE-2026-31956Xibo is an open source digital signage platform with a web c…4.3
• CVE-2026-31957Himmelblau is an interoperability suite for Microsoft Azure …10
• CVE-2026-31958Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2026-31959Quill provides simple mac binary signing and notarization fr…5.3